Analysis

  • max time kernel
    150s
  • max time network
    89s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    23-02-2021 12:54

General

  • Target

    SOA.exe

  • Size

    740KB

  • MD5

    1d3573643db9a59abcd6b937a33d1f28

  • SHA1

    7a00cb31b78616ed1f58cd3550d3ab47a2d66e4a

  • SHA256

    8eb77ec70c44e86607e97ce926cdb4e0610a0199c348fa329dba50bef34d5fc1

  • SHA512

    a4fc37960b23374d5a2fdf0e5013719a87dd5c90f7deca11ada4215db6ce1f44249f1bc1ec0b9f7071f6d3589dcef725037bf4a50147c5da02c29860b25bbc9f

Malware Config

Extracted

Family

formbook

C2

http://www.fun4gang.xyz/thg/

Decoy

retrospectphotographydesign.com

jafodraws.com

cigiwie.space

upgradecarehealth.com

12ts.xyz

111indianbend.com

qqchbakery.com

0831xx.com

supecret.com

ayfadopple.com

coldwateradvisors.com

forexgiftcard.com

actionconsultingchile.com

mpsconcrete.net

carmallc.com

b167888.com

simonking.xyz

elitedigitalperformance.com

essentialjanitorialservices.com

barcosocasionberga.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook Payload 3 IoCs
  • Deletes itself 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1264
    • C:\Users\Admin\AppData\Local\Temp\SOA.exe
      "C:\Users\Admin\AppData\Local\Temp\SOA.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1108
      • C:\Users\Admin\AppData\Local\Temp\SOA.exe
        "{path}"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:1460
    • C:\Windows\SysWOW64\cmmon32.exe
      "C:\Windows\SysWOW64\cmmon32.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:756
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\SOA.exe"
        3⤵
        • Deletes itself
        PID:928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/756-14-0x0000000000000000-mapping.dmp
  • memory/756-19-0x0000000001DC0000-0x0000000001E53000-memory.dmp
    Filesize

    588KB

  • memory/756-17-0x0000000000080000-0x00000000000AE000-memory.dmp
    Filesize

    184KB

  • memory/756-18-0x0000000001E70000-0x0000000002173000-memory.dmp
    Filesize

    3.0MB

  • memory/756-16-0x0000000000180000-0x000000000018D000-memory.dmp
    Filesize

    52KB

  • memory/928-15-0x0000000000000000-mapping.dmp
  • memory/1108-7-0x0000000005150000-0x00000000051AB000-memory.dmp
    Filesize

    364KB

  • memory/1108-2-0x0000000073E00000-0x00000000744EE000-memory.dmp
    Filesize

    6.9MB

  • memory/1108-6-0x0000000000480000-0x000000000048B000-memory.dmp
    Filesize

    44KB

  • memory/1108-5-0x00000000043C0000-0x00000000043C1000-memory.dmp
    Filesize

    4KB

  • memory/1108-3-0x00000000000B0000-0x00000000000B1000-memory.dmp
    Filesize

    4KB

  • memory/1264-13-0x0000000007460000-0x00000000075F5000-memory.dmp
    Filesize

    1.6MB

  • memory/1460-12-0x0000000000190000-0x00000000001A4000-memory.dmp
    Filesize

    80KB

  • memory/1460-11-0x0000000000870000-0x0000000000B73000-memory.dmp
    Filesize

    3.0MB

  • memory/1460-9-0x000000000041EAE0-mapping.dmp
  • memory/1460-8-0x0000000000400000-0x000000000042E000-memory.dmp
    Filesize

    184KB